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ABSTRACT. The protocol structure of the 
international aeronautical mobile satellite service 
(AMSS) is reviewed with emphasis on those aspects 
of protocol performance , validation , and 
conformance which are peculiar to mobile services. 
This is in part an analysis of what can be learned 
from the AMSS experience with protocols which is 
relevant to the design of other mobile- satellite data 
networks , e.#., land-mobile. 

1.0 INTRODUCTION 

This paper reviews material presented to the 
Aeronautical Mobile Satellite Services (AMSS) Panel 
of the International Civil Aviation Organization 
(ICAO) regarding the protocols for the planned 
international aeronautical-mobile data service. 
Particular emphasis is placed on the datalink 
protocols and some of the work being done at the 
Communications Research Centre (CRC) in this 
area. 


2.0 OVERVIEW OF AMSS AND OSI 

One underlying premise of the AMSS is that it 
is constructed in manner which is consistent with 
Open Systems Interconnect (OSI) principles and in 
particular that it uses the seven-layer protocol stack 
illustrated in Figure 1. The work of the AMSS panel 
is concerned with the bottom three layers of this 
model: the physical, the datalink and the network 
layers. However, the AMSS is viewed as 
representing a satellite subnetwork within a much 
larger Aeronautical Telecommunications Network 
(ATN), which includes numerous other subnetworks 
among which are VHF datalink networks, radar 


communication networks and fixed data networks. 
One conception of the ATN is illustrated in Figure 2. 
The prime motivation for adopting the OSI model as 
a guide in developing the AMSS is this view of 
AMSS as part of a much larger ATN. 

Among the attractions of the OSI model are 
the belief that it leads to more interoperable systems 
both intranetwork and internetwork, and the 
standard protocols available for the different 
protocol layers: protocols which have been to some 

extent validated and thoroughly tested. A further 
attraction of this approach is that the 

communication system is kept independent of the 
application, implying a much easier maintenance 
and upgrading of application software. 

The drawback of the OSI model is that it is 
inherently designed for medium and wideband data 
networks. In mobile systems, power constraints 
imply that data rates range from hundreds of bits to 
a few kilobits per second, which is one to two orders 
of magnitude lower than the typical minimum data 
rate one would find in fixed data networks. 
Consequently, the overhead due to the use of seven 
layers of protocols can use proportionately more of 
an already scarce resource. Minimizing the message 
length at the application layer only eases this 
problem slightly, because at some point the 
contribution of the protocol overhead to the total 
message length becomes dominant. 

The single example of Automatic Dependent 
Surveillance (ADS) messages illustrates many of 
these aspects of an OSI system which are important 
in mobile applications. ADS reports are aircraft 
position information derived from on-board 
navigational aids and are a potentially important air 
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traffic control application of AMSS. At the 
application layer most of the redundancy is removed 
from these messages leaving a standard message 
length of 88 bits. However, after passing through 
the top five OSI layers one calculation [1] shows that 
the message length presented to the data link layer is 
248 bits; the majority of this additional overhead is 
due to the 128-bit Network Service Access Point 
(NSAP) address standard for the ATN (128 bits) [2]. 
However, the greatest overhead (most of which is not 
attributable to OSI) occurs when this message is 
converted to the 1368 bits which are transmitted 
over the channel. This latter figure includes the bits 
needed for a burst preamble and synchronization, 
and also includes the rate 1/2 coding applied to all 
information bits. On the other hand, designing to 
OSI principles means that changes in the content or 
the length of the ADS report can be made without 
requiring any change in the delivery system. The 
interconnectability offered by the ATN means that 
the ADS report can be automatically delivered over 
the best of a number of communications 
alternatives, e.g. satellite, VHF data link, or possibly 
Mode S surveillance radar. 


This example clearly illustrates the important, 
consideration that must be given to the protocols in 
the design of a mobile data network where there is 
limited bandwidth available at the physical layer. 
Opportunities for improving performance exist at all 
the different layers. For example, at the network 
layer an NSAP address of 128 bits[2], in principle, 
allows over 10 38 destinations to be directly 
addressed, which is an extremely large amount of 
flexibility. It would be very advantageous if the 
network-datalink protocol convergence function 
limited the amount of flexibility through the use of 
some default addressing or other forms of address 
compression. 

On the other hand there may be areas where 
the potential improvements are limited. For 
example, at the physical layer the very nature of the 
mobile network implies a necessity for some form of 
random access strategy and its inherent inefficiency. 
Ideally one would minimize the use of a random 
access scheme once the mobile is logged on the 
system, performing subsequent accesses using some 
form of controlled access. However, in an OSI 
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Figure 1. The ATN protocol architecture[2]. (Legend: IP - Internetwork Protocol; 

SNDCP - Subnetwork Dependent Convergence Protocol; SNAcP - Subnetwork Access Protocol) 
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Figure 2. Conception of ATN composed of a number of interconnected subnetworks [2]. 


system the communications cannot be tailored to the 
application and as a result some inefficiencies are 
irreducible. However, there is ongoing research in 
the area of improving random access schemes [3], 
and other areas where the transmission media can be 
used more efficiently. 

The OSI layer which is most directly concerned 
with the physical communications is the datalink 
layer, and it is at this layer that there is the most 
opportunity to optimize the performance of the 
limited physical resources. This is the layer that the 
remainder of this paper will concentrate on. 

3.0 DATALINK PROTOCOLS 

There are a number of services which the 
datalink layer must provide[4], and from the 
datalink protocol proposed by INMARSAT for the 
AMSS the most important of these relevant to 
mobile systems are: 

— priority queuing of messages, 

— message segmentation and re-assembly, and 

— error detection and re-transmission. 

The combination of priorities and message 


segmentation, breaking long messages up into short 
packets of uniform length, prevent a long low 
priority message from hogging the narrow bandwidth 
datalink and causing excesssive delay to higher 
priority messages; and it also allows low priority 
messages to be interrupted by high priority messages 
and then to resume without the need to be 
completely re-transmitted. Message segmentation 
also allows the selective re-transmission of those 
portions of a message which were corrupted or lost, a 
situation which is not uncommon due the generally 
relatively poorer quality of mobile data links. 

In the case of AMSS, considerable time and 
effort has been spent by INMARSAT to develop a 
datalink protocol which attempts to optimize the 
physical resources available. The underlying 
assumption being that with sufficient optimization 
at the datalink layer, standard ISO protocols such as 
ISO 8208 (X.25), ISO 8473, and ISO 8073/8602 can 
be used at the network, internetwork, and transport 
layers, respectively [2]. 

However, even within OSI there are interlayer 
conflicts. For example, the priorities used by the 
datalink layer are derived from the standard 
priorities attached to all aeronautical 
communications by the Radio Regulations of the 
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CCIR. However, priority is not a standard Quality 
of Service (QOS) parameter for an OSI datalink 
layer, in particular, it is not a standard QOS 
parameter passed by the standard X.25 network 
protocol. Priorities could be passed as part of the 
facilities field in the X.25 protocol, but this reduces 
to some extent the benefits of using a standard 
network protocol. 

A detailed analysis of the datalink protocol for 
the AMSS will not be performed here but we will 
concentrate on some system level concerns about the 
protocol which are shared with land-mobile 
networks. 

4.0 ASPECTS OF DATALINK PROTOCOLS 

4.1 Performance 

The main performance criteria placed on a data 
communications system are average message delay, 
maximum message delay, and reliability, as a 
function of message priority. The verdict is still out 
on the what performance is expected to be provided 
by the AMSS. One conclusion is clear, initial service 
will be slow because of the low data rates available 
and the large overheads associated with the data. 
However, this is acceptable in initial AMSS which 
serves oceanic and low-density areas [5] where the 
response time is, for the most part, not critical. 
However, there have been suggestions that AMSS 
may be used for air traffic control applications in en 
route areas, where the required response time is 
significantly shorter. In this latter case a detailed 
simulation of the protocols will be necessary to 
determine if the performance requirements can be 
met. 

4.2 Protocol specification and validation 

As with the introduction of any new protocol 
there is a need to carefully specify and validate the 
protocol to insure that it performs the required 
functions, and that it does so efficiently and without 
error. Protocol validation is not a new problem, but 
it becomes increasingly important problem as the 
size and complexity of a communication network 
grows. Although protocol validation is not a new 
problem, there does not appear to be a well defined 
solution. 

The approach taken with the AMSS datalink 
protocol is to specify it using the standardized 


formal description language SDL. Languages of this 
type are designed to allow the user to express all the 
details needed to specify an implementation^]. In 
that sense they are not a minimum description of 
the protocol required to prove correctness and insure 
interoperability. While these languages are in a 
sense more complete, it has been our experience that 
at times they can also be ambiguous. 

Among the several approaches that can be 
taken to the problem of validating a protocol are the 
following [6]: 

— formal verification methods 

— implementation of the protocol and testing the 
implementation, 

— simulation of the protocol, and 

— in a few cases, it is possible to construct 
automated design procedures that can be proven 
to produce correct designs, but this an area of 
current research. 

Formal verification methods refer to the specification 
of the protocol as a transition system or the 
equivalent of communicating finite state machines. 
Then the state space of such system is exhaustively 
searched for undesired properties such as unmatched 
communication events, deadlocks, and infinite loops. 
Although such an analysis can be automated, the 
state space of such a system may grow so large with 
the number of messages and the number of machines 
present that such a verification becomes infeasible, 
although protocol validation for systems containing 
up 10 7 states have been proposed in the literature[7]. 
For example, the X.25 protocol has been partially 
verified by such an analysis. 

By choosing to specify the AMSS datalink 
protocol in SDL, simulation/implementation appears 
to be the only the available method of protocol 
validation, until a transition system description is 
available. There are several levels on which the 
protocols can be validated by 

simulation/implementation. Current work being 
performed at CRC is validating the performance of 
the datalink protocols using a minimum subset of 
the system, one AES and one GES, together with 
simulated channel conditions. Validation of the 
protocols in a more complete system is a desirable 
second step in this process, but it is not clear if this 
can be done without either performing an in-service 
validation, or simplifying the simulation and 
possibly missing some of the protocol interactions. 
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4.3 Conformance testing 

After a protocol has been validated, there 
remains the problem of insuring that all 
manufacturers conform to the standard. In theory, 
one would like to access to all interfaces between the 
different OSI layers, however, cost and 
manufacturer’s design usually make this impractical. 
Furthermore, the goal of a standard is 
interoperability of different manufacturers’ 
equipments rather than explicit specification of an 
implementation. This has the consequence that there 
are a limited number of standard test points 
available for testing protocol conformance. For 
example in the ICAO standard for AMSS, the only 
test points available for testing conformance are the 
interfaces at the network layer and the interface at 
the physical layer, that is, the signal-in-space as 
shown in Figure 3. As a consequence, the approach 
to testing equipment conformance will in general be 
very different from validating the protocol. In the 
latter, one can isolate the different OSI layers and 
validate each independently; while with the former, 
end-to-end conformance may be the only test 
available. Since the number of variations can 
increase exponentially with the number of layers 
combined, the latter may perform a far greater 

testing problem, and the only approach would 

appear to be insertion of the equipment in a 
simulation test suite where a equipment conformance 
can be tested over a wide range of standard 
scenarios[8]. The one saving grace is that this type 
of test only needs to done once for each 

implementation, and that there are a limited 

number of manufacturers. 


A potential future problem is the correction of 
problems found in the protocol after the system has 
gone into service. There may be questions as to 
whether implementations must go through a formal 
test procedure with each upgrade or whether in- 
service testing can be sufficient. Another 

consideration is that, because of its size and the 
number of users, the complete system will not be 
upgraded simultaneously and thus each upgrade 
should be backwardly compatible. 

5.0 CONCLUSIONS 

In this paper several observations have been 
made about the development of the AMSS 
communication protocols and their implementation, 
emphasizing those areas which are relevant to other 
mobile systems. The OSI approach offers great 

flexibility and interconnectability to data 
communications with the penalty of significant 
protocol overhead. The implication is that in a 
narrowband system, such as mobile-satellite 
networks, great care should be taken to minimize 
these overheads at all layers. At the datalink layer, 
in particular, there is the opportunity to optimize 
the use of the available physical resources. However, 
it is clear that protocol validation should be 
performed as early as possible in the design process, 
and that each subsequent design change should be 
validated; in that way, the cost of correcting errors is 
minimized. 



Satellite Link 
Slgnal-in-Space 


Figure 3, Illustration of test points available for protocol conformance test. 
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